CVE-2018-12626

Eventum 3.5.0 is affected by a cross-site scripting vulnerability in /htdocs/popup.php via the cat parameter. Impact is described as client-side code execution with partial integrity impact (per CVE notes). Connected advisories from Red Hat and CNVD/EUVD mirrors confirm the same issue exists in E...

CVE-2018-12625

An issue was discovered in Eventum 3.5.0. /htdocs/validate.php has XSS via the values parameter...

CVE-2018-12625

CVE-2018-12625 affects Eventum 3.5.0, with an XSS vulnerability in /htdocs/validate.php via the values parameter. The connected sources corroborate a client-side data validation issue in Eventum 3.5.0; no further exploit details are provided in the provided documents. The NVD entry lists a CVSS v...

CVE-2018-12623

Eventum 3.5.0 is affected by a cross-site scripting (XSS) vulnerability in htdocs/switch.php via the current_page parameter. Public sources (NVD) describe the issue and assign CVE-2018-12623 with a CVSS v2 base score of 4.3 (medium) and CVSS v3 base score of 6.1 (medium); attack requires no user ...

CVE-2018-12623

An issue was discovered in Eventum 3.5.0. htdocs/switch.php has XSS via the currentpage parameter...

CVE-2018-12622

An issue was discovered in Eventum 3.5.0. htdocs/ajax/update.php has XSS via the fieldname parameter...

CVE-2018-12622

Eventum 3.5.0 is affected by an XSS in htdocs/ajax/update.php via the field_name parameter. The issue is reflected XSS with potential impact on confidentiality/integrity (per CVSSv3 6.1, MEDIUM). No exploit details or patch version are provided in the documents; a later release 3.5.2 is reference...

CVE-2018-12622: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Eventum 3.5.0. htdocs/ajax/update.php has XSS via the fieldname parameter...

CVE-2018-12623: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Eventum 3.5.0. htdocs/switch.php has XSS via the currentpage parameter...

CVE-2018-12628: Cross-Site Request Forgery (CSRF)

An issue was discovered in Eventum 3.5.0. CSRF in htdocs/manage/users.php allows creating another user with admin privileges...

CVE-2018-12625: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Eventum 3.5.0. /htdocs/validate.php has XSS via the values parameter...

CVE-2018-12626: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Eventum 3.5.0. /htdocs/popup.php has XSS via the cat parameter...

CVE-2018-12627: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Eventum 3.5.0. /htdocs/list.php has XSS via the shownotificationlistissues or showauthorizedissues parameter...

CVE-2018-12621

An issue was discovered in Eventum 3.5.0. /htdocs/switch.php has an Open Redirect via the currentpage parameter...

CVE-2018-12621

An issue was discovered in Eventum 3.5.0. /htdocs/switch.php has an Open Redirect via the currentpage parameter...

Open redirect

An issue was discovered in Eventum 3.5.0. /htdocs/switch.php has an Open Redirect via the currentpage parameter...

CVE-2018-12621

An issue was discovered in Eventum 3.5.0. /htdocs/switch.php has an Open Redirect via the currentpage parameter...

CVE-2018-12621

CVE-2018-12621 affects Eventum 3.5.0 with an Open Redirect in /htdocs/switch.php via the current_page parameter. The issue enables redirection to arbitrary URLs. No explicit remediation or patch version is provided in the connected documents; details about exploit availability or mitigations are ...

CVE-2018-12621: URL Redirection to Untrusted Site

An issue was discovered in Eventum 3.5.0. /htdocs/switch.php has an Open Redirect via the currentpage parameter...

Eventum Cross-Site Scripting Vulnerability

Eventum is a defect tracking system. The system is used to track inbound technical support, organizational tasks, bugs, etc. A cross-site scripting vulnerability exists in the /htdocs/postnote.php file in Eventum version 3.5.0. The vulnerability stems from a lack of proper validation of client-si...